Description
Mermaid’s default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.
Live demo: mermaid.live
Recommendation
Update the mermaid package to the latest compatible version. Followings are version details:
Affected version(s): **<= 10.9.5 >= 11.0.0-alpha.1, <= 11.14.0** Patched version(s): **10.9.6 11.15.0**
References
Could your website be exposed too?
SmartScanner can check your website for Mermaid: Improper sanitization of configuration leads to CSS injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection - CVE-2026-41148
- Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection - CVE-2026-41149
- Mermaid allows CSS injection applying to sibling elements of the diagram - CVE-2026-50159
- Improper Control of Generation of Code ('Code Injection') in mdx-mermaid - CVE-2022-36036
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026